9af554ba92b5e6d6370be309e5065e45d20a302569e41756a1d83437025dc707

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f635f77ebdf1edc166ad648aa8a74292_JaffaCakes118.exe
Size

316KB
MD5

f635f77ebdf1edc166ad648aa8a74292
SHA1

d1d0472d2628ab6767991d15304ea12fb93aa4ef
SHA256

9af554ba92b5e6d6370be309e5065e45d20a302569e41756a1d83437025dc707
SHA512

71598abec1ebb09c03516443f3d770f662f4ef208a5f97700fd5ad024fc87394482e8f03cc6f643acc38b9a22f0d4ade9a18129d5f89ca05056a253e21bc41ca
SSDEEP

768:zSUo7qV+lPD942woOQP0OHllSpOZUcJ/KV8AghUlxL/+Qoo+o+paJNKouo+paJNP:to4+Uoc8bJSGA6UjaZaJ4paJ2e5aJGV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f635f77ebdf1edc166ad648aa8a74292_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f635f77ebdf1edc166ad648aa8a74292_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f635f77ebdf1edc166ad648aa8a74292_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...